Live Kernel-Mode Targets

To attach the debugger engine to a target computer for kernel-mode debugging, use the method AttachKernel.

Note   The engine doesn't completely attach to the kernel until the WaitForEvent method has been called. Only after the kernel has generated an event -- for example, the initial breakpoint -- does it become available in the debugger session. See Debugging Session and Execution Model for more details.

If the debugger engine is attached to a kernel which is not the local kernel and the connection is not an eXDI connection, the connection options used to find the target computer can be queried using GetKernelConnectionOptions. The connection can also be re-synchronized or the connection speed changed using SetKernelConnectionOptions.

The debugger can attach to the local kernel, but only in a limited way and only if the computer was booted with the /debug boot switch. (In some Windows installations, local kernel debugging is supported when other switches are used, such as /debugport, but this is not a guaranteed feature of Windows and should not be relied on.) IsKernelDebuggerEnabled is used to determine if the local computer is available for debugging. For more information about kernel debugging on a single machine, see Performing Local Kernel Debugging.